Subject: Policy on the processing, communication and dissemination of data, in application of the European Data Protection Regulation - -Reg. 679/2016 (GDPR)

PREMESSA

Pursuant to articles 13 and 14 of EU Regulation 2016/679 (GDPR), laying down provisions for the protection of individuals with regard to the processing of personal data, the Data Controller is required to provide interested parties with some information regarding the use of their personal data.

In particular, the writer Pentax Industries SpA during the contractual or pre-contractual relationship, acting in the role of Data Controller in accordance with the GDPR, in relation to the proper provision of design, implementation and marketing services for water and fluids in the industrial and domestic sector, will need to process so-called personal data, as referable, directly or indirectly to natural persons belonging to its organization, as well as economic / technical / administrative / organizational data necessary to fulfill the related legal obligations o relating to the organization of the services.

The information and personal data, provided by you, or acquired within the contractual relationship with the writer, are treated in compliance with the laws in force and the confidentiality obligations that have always inspired the activity of Pentax Industries SpA.

The data controller is: Pentax Industries SpA.

Viale dell'Industria, 1 -

37040 Veronella (VR) Italia -

Tel.: +39 0442 489 500 Fax +39 0042 489 510

privacy@pentax-pumps.it

PURPOSE OF DATA PROCESSING

The processing of data is aimed at the pre-contractual and contractual management of the activities carried out on behalf of the client by Pentax Industries SpA. In particular, we highlight the following purposes

Commercial and pre-contractual management, in relation to all the activities that preceded the contractual stipulation;

Administrative and accounting management;

Management of the supply, delivery and assistance services of the solutions and products supplied as per contract and / or order

Sales and promotional post-sales management, in relation to solutions, new products, organization of events, in line with the proposed services and solutions.

The processing will be carried out with the main support of electronic tools, and may cover data and information on computer or paper media, by authorized individuals.

In general, for the aforementioned purposes, depending on the case, the data will be stored at our company, at the customer's IT infrastructure, at our data centers, or at our suppliers' datacenter, and will be communicated exclusively to the competent subjects, internal or external to the organization, as described below, for the completion of the services necessary for the proper management of the contractual relationship and the underlying services with a guarantee of protection of the rights of the interested party.

LEGALITY AND LEGAL BASES OF PROCESSING

The processing of personal data by the Owner is legitimized by the following conditions (art.6 of the GDPR):

The interested party has given his consent to the processing of his personal data for one or more specific purposes.

The processing is necessary for the execution of a contract of which the interested party is a party and for the possible execution of pre-contractual or post-contractual measures adopted at the request of the same.

The processing is necessary to fulfill a legal obligation to which the Data Controller is subject (in particular for administrative and accounting purposes).

SCOPE OF DISTRIBUTION AND CATEGORIES OF PERSONS TO WHICH MAY BE DISCLOSED DATA, ANY LIABILITY DOMAINS

Personal data collected by Pentax Industries SpA may be disclosed, within the limits and in the forms strictly relevant to the aforementioned purposes, also to the following subjects or categories of subjects:

Subjects to whom communication is required by law, by regulation or by national and community legislation as well as for the performance of contractual or pre-contractual obligations.

Credit Institutions, Insurance Companies and other entities for the execution of contractual or pre-contractual obligations (disbursement of payments, stipulation of compulsory insurance policies, etc.);

External studies and professionals specialized in consulting for the management of accounting and tax aspects for the fulfillment of the law (eg accountant, auditing company, etc)

Companies that carry out any activities of transport and shipment of the goods in relation to the customer's personal details.

PROVISION OF DATA AND CONSEQUENCES OF FAILURE TO COMPULSORY / NON-COMPULSORY PROVISION

The provision of data must be considered mandatory with regard to the processing that the organization must carry out to fulfill its obligations towards the data subject on the basis of the existing relationship (or contract), as well as legal obligations, rules, regulations - see paragraph finality, b) and c) - Failure to provide such data may make it impossible for Pentax Industries SpA to proceed with the current relationship.

The provision is not mandatory for all other purposes and, even if conferred, can be revoked at any time by the interested party. In the event of failure to provide consent, the consequences will be assessed from time to time, having regard to the specific case. For the purposes of type d) communications will always be accompanied by an information for the processing of data and will always be given the right to withdraw from communications of a commercial or promotional nature.

DATA CONSERVATION PERIOD

The data are kept only for the period necessary for the purposes for which they are processed or within the terms provided for by national and Community laws, rules and regulations to which the organization must comply (eg accounting and tax regulations, etc.). It is expected that a periodic check will be carried out annually on the data processed and on the possibility of being able to cancel them if no longer necessary for the intended purposes.

The Owner undertakes to provide feedback to the interested parties within 30 days and, in the event of impossibility to comply with these deadlines, to justify any extension of the deadlines. The response will be free of charge, except in cases of groundlessness or excessive requests for which a fee may be charged that is not higher than the costs actually incurred for the research carried out.

In particular, please note the rights of the data subject to access, rectification or deletion of data, and those to the limitation or opposition to processing, as shown in the tables below.

Access (art.15)

- Confirmation of the data processing of the data subject by the Data Controller.

- Access to personal data by the data subject processed by the Data Controller.

- Information on purposes, categories of processed data, recipients of any communications (especially if in third countries), expected retention period and origin of the data collected from third parties.

- Information on the existence of the right to rectification or deletion of data and limitation or opposition to their processing and to lodge a complaint with the Guarantor.

- Possible existence of an automated decision-making process or profiling, information on the logic used and the consequences of such processing.

Correction (art.16)

- Correction by the Owner, without unjustified delay, of the incorrect personal data concerning the interested party and

- integration of incomplete personal data.

Cancellation

(art.17)

In cases of:

- data no longer necessary for the purposes for which they were collected;

- withdrawal of consent, if there is no other legal basis for the processing;

- opposition to treatment, if there is no legitimate overriding reason;

- unlawful processing;

- legal obligation;

- and finally, in cases related to the consent of minors, with regard to the provision of information society services.

Limitation (art.18)

Temporary regime of abstention from processing in cases of:

- contestation of accuracy,

- opposition to cancellation in case of unlawful processing,

- data no longer necessary for the Data Controller but necessary for the data subject to exercise a right,

- opposition to processing

Pending the conclusion of the investigations, the Data Controller is required to retain the data and performs any other processing only under certain conditions.

Portability (art.20)

As regards processings based on consent or on a contract, the data subject is entitled to receive from the Data Controller his personal data in “common” electronic format in order to transmit them to another Data Controller (also directly from the Data Controller to the Data Controller)."portable"personal data are those that the subject has provided directly and explicitly to the Owner, but also those collected during the provision of the service, such as, for example, traffic or navigation data (for network service providers) .

Opposition (art.21)

Opposition to the processing of personal data based on the criteria of lawfulness of the exercise of public interest or of the legitimate interest of the Owner, including direct marketing or any profiling.

The Data Controller refrains from processing, except for legitimate reasons that prevail over the interests, rights and freedoms of the interested party, or for verification, exercise or defense of a right in court.

The Data Controller is obliged in any case to stop processing for direct marketing purposes if the data subject opposes the use of their data for this purpose.

Other rights recognized to the interested parties are those of the following table.

Complaint (art.77)

Right to propose a complaint to a Supervisory Authority (Privacy Guarantor), where the interested party considers that the processing that concerns him / her violates the Regulation

Compensation (art.82)

Right to obtain from the Owner and / or the Manager the full and effective compensation for any damage suffered, material or immaterial (financial loss, identity theft, discrimination, etc.), if caused by the processing of personal data of the data subject in violation of the Rules and the Data Controller and / or the Data Manager are not able to prove that the harmful event is not attributable to them.

As regards the processings legitimated by a consent, the interested party has the right to revoke it at any time without prejudice to the lawfulness based on the consent given prior to the revocation.

Best regards.

THE DATA CONTROLLER

Dear Sir, Dear Madam

Our company is constantly looking for the best talents. This can be done through your
spontaneous application (so-called voluntary application) or through our specific researches that
we promote through direct contacts or adverts. We inform you, therefore, that the data relating
to you and contained in the curriculum, as well as any data processed during the selection
interview, are acquired and processed in paper form and on magnetic, electronic or telematic
support solely for the purpose of evaluating our possible interest in the establishment of a
working and / or collaboration relationship.

These data could be included in the category of the so-called “sensitive data“, defined as personal
data disclosing racial and ethnic origin, religious, philosophical or other beliefs, political opinions,
parties, trade unions, associations of religious, philosophical or political organizations or trade
union membership and personal data disclosing health status (eg. minority group, disability and
the percentage of disability) and sex life.

Your application will remain in our database for a duration not exceeding that one required for the
purposes for which the data were collected, unless their cancellation is specifically requested.
The provision of the data is optional, however, your refusal to provide them and the subsequent
processing, implies the impossibility for us to enter your data in our database, therefore the
impossibility for us to carry out any assessment necessary for the selection process.

We assure you that the data acquired will be processed exclusively for the research and selection
of personnel on our behalf, or companies within our Group, to which the collected data can be
communicated recommending to process them with the same confidentiality that we have always
used and in any case in full compliance with current legislation that protects personal privacy. Pentax Industries Spa undertakes not to disclose any data collected without prior approval by the
person concerned.

With regard to the data themselves you can exercise at any time the rights provided for by art. 7
of the legislative decree n. 196/2003, for example the right at any time to obtain information on
the processing of your data, its methods and purposes and the logic applied to it, and in particular
request cancellation. For any clarification you can contact us at the following addresses: